diff options
author | Damien Miller <djm@mindrot.org> | 2014-03-04 09:35:17 +1100 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2014-03-04 09:35:17 +1100 |
commit | 8569eba5d7f7348ce3955eeeb399f66f25c52ece (patch) | |
tree | 76d21af5de19f44ccc95ce5900f293ab84eb605a /session.c | |
parent | 2476c31b96e89aec7d4e73cb6fbfb9a4290de3a7 (diff) |
- djm@cvs.openbsd.org 2014/03/03 22:22:30
[session.c]
ignore enviornment variables with embedded '=' or '\0' characters;
spotted by Jann Horn; ok deraadt@
Diffstat (limited to 'session.c')
-rw-r--r-- | session.c | 9 |
1 files changed, 7 insertions, 2 deletions
@@ -978,6 +978,11 @@ child_set_env(char ***envp, u_int *envsizep, const char *name, | |||
978 | u_int envsize; | 978 | u_int envsize; |
979 | u_int i, namelen; | 979 | u_int i, namelen; |
980 | 980 | ||
981 | if (strchr(name, '=') != NULL) { | ||
982 | error("Invalid environment variable \"%.100s\"", name); | ||
983 | return; | ||
984 | } | ||
985 | |||
981 | /* | 986 | /* |
982 | * If we're passed an uninitialized list, allocate a single null | 987 | * If we're passed an uninitialized list, allocate a single null |
983 | * entry before continuing. | 988 | * entry before continuing. |
@@ -2225,8 +2230,8 @@ session_env_req(Session *s) | |||
2225 | char *name, *val; | 2230 | char *name, *val; |
2226 | u_int name_len, val_len, i; | 2231 | u_int name_len, val_len, i; |
2227 | 2232 | ||
2228 | name = packet_get_string(&name_len); | 2233 | name = packet_get_cstring(&name_len); |
2229 | val = packet_get_string(&val_len); | 2234 | val = packet_get_cstring(&val_len); |
2230 | packet_check_eom(); | 2235 | packet_check_eom(); |
2231 | 2236 | ||
2232 | /* Don't set too many environment variables */ | 2237 | /* Don't set too many environment variables */ |